CVE-2025-12633 Overview
The Booking Calendar | Appointment Booking | Bookit plugin for WordPress contains a missing authorization vulnerability in versions up to and including 2.5.0. The flaw resides in the /wp-json/bookit/v1/commerce/stripe/return REST API endpoint, which lacks a capability check. Unauthenticated attackers can invoke this endpoint to connect their own Stripe account to a vulnerable site and redirect future payments to themselves. The issue is tracked under CWE-862: Missing Authorization and was patched in version 2.5.1.
Critical Impact
Unauthenticated attackers can hijack Stripe payment configuration on affected WordPress sites and divert customer payments to attacker-controlled accounts.
Affected Products
- Booking Calendar | Appointment Booking | Bookit plugin for WordPress, all versions up to and including 2.5.0
- Fixed in version 2.5.1
- WordPress sites using the Stripe Connect integration provided by the Bookit plugin
Discovery Timeline
- 2025-11-12 - CVE-2025-12633 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-12633
Vulnerability Analysis
The Bookit plugin exposes a REST API route at /wp-json/bookit/v1/commerce/stripe/return that handles the OAuth return flow for the Stripe Connect integration. In versions through 2.5.0, the endpoint registration in Return_Endpoint.php does not enforce a permission_callback that validates the caller's WordPress capabilities. Any unauthenticated HTTP client can therefore invoke the route directly.
Because the endpoint completes the Stripe Connect onboarding flow, an attacker can submit attacker-controlled Stripe parameters and bind their own Stripe account to the site's Bookit configuration. Once linked, payments processed through the booking workflow are routed to the attacker's Stripe account rather than the site owner's. The vulnerability impacts integrity by allowing unauthorized modification of payment configuration data, but does not directly disclose data or crash the service.
Root Cause
The root cause is a missing capability check on a publicly registered WordPress REST route. The permission_callback parameter on the route is either absent or returns true unconditionally, violating the WordPress REST API guidance that every route must validate authorization before performing privileged actions.
Attack Vector
Exploitation requires only network access to the target site's REST API. An attacker sends a crafted HTTP request to /wp-json/bookit/v1/commerce/stripe/return containing Stripe Connect callback parameters that point to an attacker-owned Stripe account. No authentication, user interaction, or special privileges are required. See the WordPress plugin change log for the corrective patch and the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2025-12633
Indicators of Compromise
- Unexpected HTTP requests to /wp-json/bookit/v1/commerce/stripe/return originating from external or unknown IP addresses.
- Stripe account identifiers in the Bookit plugin configuration that do not match the site owner's legitimate Stripe Connect account.
- Booking confirmations where payments do not arrive in the merchant's Stripe dashboard despite successful customer charges.
Detection Strategies
- Review WordPress and web server access logs for GET or POST requests to the bookit/v1/commerce/stripe REST namespace, especially without an authenticated session cookie.
- Audit the wp_options table and Bookit plugin settings for recent changes to Stripe Connect account identifiers, client IDs, or refresh tokens.
- Compare the currently configured Stripe account ID against the merchant's expected acct_* identifier and alert on mismatches.
Monitoring Recommendations
- Enable WordPress audit logging to record REST API calls and configuration changes for payment-related plugins.
- Forward web server and application logs to a centralized log analytics platform and create alerts for anonymous access to commerce-related REST routes.
- Monitor Stripe dashboard webhook events for unexpected account linkage or disconnection activity on production sites.
How to Mitigate CVE-2025-12633
Immediate Actions Required
- Update the Bookit plugin to version 2.5.1 or later on all WordPress sites where it is installed.
- Verify that the Stripe Connect account currently linked in the Bookit settings is the legitimate merchant account and disconnect any unknown account.
- Rotate Stripe API keys and review recent payouts and Connect onboarding events for unauthorized activity.
Patch Information
The maintainers fixed the issue in Bookit version 2.5.1 by adding a proper capability check to the Stripe return endpoint. The corrective code change is documented in the WordPress plugin change log. Site administrators should apply the update through the WordPress plugin manager or via WP-CLI.
Workarounds
- If immediate patching is not possible, deactivate the Bookit plugin until the upgrade to 2.5.1 can be performed.
- Block external access to the /wp-json/bookit/v1/commerce/stripe/return route at the web application firewall or reverse proxy layer.
- Restrict access to the WordPress REST API for unauthenticated users on sites that do not require public REST consumption.
# Configuration example: update the Bookit plugin via WP-CLI
wp plugin update bookit --version=2.5.1
wp plugin list --name=bookit --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
